The flaw is present in EasyCMS versions up to 1.6 and is triggered by manipulating the _order argument in the RbacnodeAction.class.php component. The injection allows an attacker to execute arbitrary SQL statements against the backend database, potentially leading to data theft, data modification or unauthorized access to administrative credentials. This directly undermines both the confidentiality and integrity of the data stored by the application.

Any installation of EasyCMS running version 1.6 or earlier is susceptible. No vendor‑specific patch is currently available because the vendor did not respond to the disclosure. All affected instances rely on the default parameter handling for _order.

The CVSS base score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is remote and publicly documented on several sites, which could increase future exploitation attempts. Because the exploit path does not require authentication and can be activated over the network, the risk to the database is significant if the system is exposed to the internet.